CVE-2026-76174: Multiple vulnerabilities in Ocsreports for OCS Inventory NG

Published Sep 3, 2026

Updated

Unrestricted file upload vulnerability in the CSV file upload functionality of the Ocsreports admininfo endpoint. The application validates files solely based on the name provided by the client, without properly checking their content or securely restricting the permitted file types. This allows a user with administrator privileges to upload PHP files to a directory accessible via the web interface. If the file is subsequently processed by the server, an attacker could execute arbitrary code with the privileges of the account used by the web service.

Affected Software

1 affected component

OCS Inventory Ocsreports

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade OCS Inventory NG / Ocsreports to a version that resolves this vulnerability.
Fixed in 2.12.6

Event History

Sep 3, 2026

CVE Published

via MITRE·09:38 AM

Data Sourced

via MITRE·09:38 AM

RemedyDescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs administrator privileges in Ocsreports to access the affected CSV upload functionality.

What conditions are required for code execution?

The uploaded PHP file must be placed in a directory accessible through the web interface and subsequently processed by the server. Successful execution would run with the privileges of the account used by the web service.